Read the docs
TI-2026-42699 Aliases CVE-2026-59885GHSA-8ppf-4f7h-5ppj

pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 25 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00616 49th percentileScored 2026-11-07
Fix Partial pyasn1 (pyasn1): 0.6.4pyasn1 (PyPI): 0.6.4Red Hat: 21 advisoriesRed Hat: 19 fixed, 25 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pyasn1pyasn1before 0.6.40.6.4Patch availableCNA
—pyasn1 (PyPI)before 0.6.40.6.4Patch availableGHSA-8ppf-4f7h-5ppj
  • pyasn1 Vendorpyasn1 Affected before 0.6.4 Fixed in 0.6.4 Patch available CNA
  • pyasn1 (PyPI) Vendor— Affected before 0.6.4 Fixed in 0.6.4 Patch available GHSA-8ppf-4f7h-5ppj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:*before 0.6.4Vulnerablepyasn1
  • cpe:2.3:a:pyasn1:pyasn1:*:*:*:*:*:python:*:* Versions before 0.6.4 Vulnerable ·pyasn1

Remediation

  • Fix · CNA pyasn1 (pyasn1) Fixed in 0.6.4
  • Fix · GHSA-8ppf-4f7h-5ppj pyasn1 (PyPI) Fixed in 0.6.4 Advisory →

Red Hat 21 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83121 Released 2026-10-14 · Red Hat rating Important
    Red Hat AI Inference 3.4.6 (rocm)
    • Red Hat AI Inference Server 3.4 registry.redhat.io/rhaii/vllm-rocm-rhel9
Show 18 more Red Hat advisories
  • RHSA-2026:77532 Released 2026-10-07 · Red Hat rating Important
    Release of components for Service Telemetry Framework 1.5.7
    • Red Hat OpenStack 1.5 registry.redhat.io/stf/prometheus-webhook-snmp-rhel9, registry.redhat.io/stf/sg-core-rhel9
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:62336 Released 2026-09-01 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.6 enhancement update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
  • RHSA-2026:62335 Released 2026-09-01 · Red Hat rating Important
    Red Hat Enterprise Linux AI 3.3.6 enhancement update
    • Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59518 Released 2026-08-25 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.3.6 (CUDA)
    • Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:56347 Released 2026-08-18 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-analyzer-addon-rhel9, registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-discovery-addon-rhel9 +4
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:53520 Released 2026-08-11 · Red Hat rating Important
    Red Hat Quay 3.10.25
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:52968 Released 2026-08-10 · Red Hat rating Important
    Red Hat Quay 3.12.21
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50931 Released 2026-08-05 · Red Hat rating Important
    Red Hat Quay 3.9.25
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50336 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
  • RHSA-2026:50319 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.31-1.el8ap, automation-eda-controller-1.1.21-1.el8ap, automation-eda-controller-base-1.1.21-1.el8ap +11
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.31-1.el9ap, automation-eda-controller-1.1.21-1.el9ap, automation-eda-controller-base-1.1.21-1.el9ap +11
  • RHSA-2026:48933 Released 2026-07-30 · Red Hat rating Important
    Red Hat Quay 3.15.7
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40236 Released 2026-07-15 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images jaeger-2.19.0-1.1.hum1@aarch64, jaeger-2.19.0-1.1.hum1@src, jaeger-2.19.0-1.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix yet: Fix deferred
Lightspeed CoreAffectedNo fix yet: Fix deferred
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Migration Toolkit for VirtualizationAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
Red Hat AI Inference Server 3.3Fixed RHSA-2026:59518
Red Hat AI Inference Server 3.4Fixed RHSA-2026:83121
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:50336
Red Hat Enterprise Linux AI 3.3Fixed RHSA-2026:62335, RHSA-2026:62336
Red Hat Hardened ImagesFixed RHSA-2026:40236
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:56347
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126, RHSA-2026:87410
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenStack 1.5Fixed RHSA-2026:77532
Red Hat Quay 3.10Fixed RHSA-2026:53520
Red Hat Quay 3.12Fixed RHSA-2026:52968
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:48933
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:50931
Not affected: 24 products
  • Migration Toolkit for Applications 8
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Enterprise Linux AI 3.3
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenStack 1.5
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Service Telemetry Framework 1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59885
  2. 2026-10-03 Alias added: GHSA-8ppf-4f7h-5ppj
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:77532 · Red Hat
  5. 2026-10-07 Fix available: Red Hat OpenStack 1.5 · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83121 · Red Hat
  7. 2026-10-16 Fix available: Red Hat AI Inference Server 3.4 · Red Hat
  8. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  11. 2026-10-23 Affected versions changed · Red Hat
  12. 2026-10-30 Affected versions changed · Red Hat
  13. 2026-11-03 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2026-23747 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVSS 3.1HIGH 7.5
  • TI-2026-18923 pyasn1 has a DoS vulnerability in decoder CVSS 3.1HIGH 7.5
  • TI-2026-42698 pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs CVSS 3.1HIGH 7.5
  • TI-2026-42700 pyasn1: Uncontrolled resource consumption when converting decoded REAL values CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences